Beyond Public Access in LLM Pre-Training Data

Ilan Strauss; Sruly Rosenblat; Tim O'Reilly

Beyond Public Access in LLM Pre-Training Data

T0 review · 2 major / 2 minor · reviewed 2026-05-22 · grok-4.3

Challenge this review Download PDF Read on arXiv ↗

Pith's one-line read Applying a membership inference attack to 34 copyrighted books finds patterns consistent with GPT-4o having encountered paywalled content during pre-training.

desk verdict Small-sample DE-COP results on 34 O'Reilly books show a GPT-4o AUROC gap over the mini version, but scale and architecture differences weaken the specific membership claim. read the letter →

arxiv 2505.00020 v2 submitted 2025-04-24 cs.CL cs.AI

Sruly Rosenblat , Tim O'Reilly , Ilan Strauss This is my paper

classification cs.CLcs.AI

keywords LLMpre-trainingdatacopyrightedcontentmembershipinferenceattackOpenAImodelspaywalledbookstransparency

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tests whether large language models can recognize specific copyrighted books that were not freely available online. It applies the DE-COP membership inference attack to a small set of 34 O'Reilly Media titles and reports that GPT-4o produces recognition scores consistent with prior exposure, reaching an AUROC of 0.82, while the smaller GPT-4o Mini shows little such signal. The authors separate results for public versus non-public data and note that this limited sample still points to the value of corporate transparency and formal licensing for training material. A sympathetic reader would care because the finding bears directly on whether current models have incorporated protected works without authorization.

What carries the argument

The DE-COP membership inference attack, a method that measures whether a model shows differential recognition of specific text passages to infer prior exposure.

What would settle it

Repeating the DE-COP attack on the same 34 books with models whose training data is independently verified to exclude all O'Reilly titles and obtaining comparable AUROC scores above 0.7 would indicate the signal does not track specific copyrighted exposure.

Watch

Extended reading notes

Core claim

Using the DE-COP membership inference attack on a legally obtained set of 34 copyrighted O'Reilly Media books, the authors find that GPT-4o exhibits patterns consistent with recognition of the pay-walled content, with an AUROC score of 0.82, while GPT-4o Mini shows little recognition. The work emphasizes examining public and non-public data separately and concludes that these preliminary results highlight the need for greater transparency about pre-training sources and the development of formal licensing frameworks.

Load-bearing premise

The DE-COP attack can reliably distinguish actual training exposure to the exact copyrighted books from detection of similar public content or effects of model size and architecture.

Editorial extensions

If this is right

Larger, more capable models appear more likely to retain detectable traces of non-public copyrighted material.
Separate analysis of public and non-public data strengthens evidence that observed recognition is not explained by freely available sources alone.
The results support calls for companies to disclose pre-training data sources and to pursue licensing agreements for copyrighted books.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same attack could be applied to other publishers' paywalled catalogs to map which models show exposure to which protected works.
If the signal holds, it supplies one concrete data point for legal or regulatory discussions about unauthorized use of copyrighted material in training sets.
Performance differences between model sizes suggest that scaling may increase the chance of ingesting and retaining protected content.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The paper applies the DE-COP membership inference attack to 34 copyrighted O'Reilly books and finds that GPT-4o has an AUROC of 0.82 on the non-public data while GPT-4o Mini sits at 0.56. They highlight the separation between public and non-public analysis as their main contribution. This is a straightforward extension of prior work to a new, legally sourced dataset. The authors do a decent job flagging the small sample and the resulting wide confidence intervals, and they note that model size and architecture differences limit how much their same-cutoff-date comparison can control for other factors. The soft spot is exactly that control. Without an ablation that holds scale fixed or tests the attack on comparable public books, the higher score in the larger model could reflect better pattern recognition for book content in general rather than specific pre-training on these 34 titles. The stress test concern about scale effects seems to land here. This kind of paper is for researchers following membership inference techniques and for anyone tracking copyright exposure in LLM training data. A reader who wants concrete numbers on this issue will get value from it, even with the caveats. It deserves a serious referee. The empirical application is new enough and the question is important enough that review would help tighten the claims and controls. I would recommend sending it to peer review.

Referee Report

2 major / 2 minor

Summary. The paper applies the DE-COP membership inference attack to a legally obtained set of 34 copyrighted O'Reilly Media books to test whether OpenAI LLMs recognize pay-walled content. It reports AUROC scores of 0.82 (95% CI 0.60-0.96) for GPT-4o and 0.56 (0.28-0.83) for GPT-4o Mini on non-public data, interpreting the gap as evidence of pre-training exposure while using the same cutoff date as a partial temporal control; the principal contribution is the separate examination of public versus non-public data.

Significance. If the central empirical result holds after addressing controls, the work would offer concrete evidence relevant to ongoing debates on copyrighted material in LLM pre-training, supporting calls for greater transparency and formal licensing. The use of a legally obtained dataset and explicit reporting of bootstrapped confidence intervals are strengths that enhance credibility.

major comments (2)

Abstract and results: the claim that the AUROC gap (0.82 vs. 0.56) indicates recognition of the specific 34 pay-walled books is weakened by unaddressed differences in model size, architecture, and training composition; the paper notes these limit the temporal control but provides no ablation holding scale fixed or baseline on public O'Reilly-style books.
Abstract: the small sample of 34 books produces wide confidence intervals (0.60-0.96), which the paper acknowledges as reflecting uncertainty yet still uses to support the interpretation of 'patterns consistent with recognition of pay-walled book content.'

minor comments (2)

Clarify the exact criteria and procedure used to classify O'Reilly content as public versus non-public, as this separation is stated to be the principal contribution.
Add a short discussion of how DE-COP thresholds or decision rules were chosen for this domain to improve reproducibility.

Simulated Author's Rebuttal

2 responses · 1 unresolved

We thank the referee for their detailed and constructive review. We address each major comment below, clarifying our approach and making revisions where appropriate to better highlight limitations and the scope of our claims.

read point-by-point responses

Referee: Abstract and results: the claim that the AUROC gap (0.82 vs. 0.56) indicates recognition of the specific 34 pay-walled books is weakened by unaddressed differences in model size, architecture, and training composition; the paper notes these limit the temporal control but provides no ablation holding scale fixed or baseline on public O'Reilly-style books.

Authors: We agree that differences in model size, architecture, and training composition weaken the temporal control and limit causal claims about the specific 34 books. The manuscript already states these factors limit the control. Our principal contribution remains the separate examination of public versus non-public data, which functions as an internal baseline showing how the DE-COP attack behaves on known public O'Reilly content. We have revised the abstract and results to more explicitly qualify the AUROC gap as suggestive rather than definitive evidence of pre-training on the pay-walled books. A controlled ablation holding scale and architecture fixed is not feasible, as it would require proprietary intermediate models unavailable to us; we have added further discussion of this limitation. revision: partial
Referee: Abstract: the small sample of 34 books produces wide confidence intervals (0.60-0.96), which the paper acknowledges as reflecting uncertainty yet still uses to support the interpretation of 'patterns consistent with recognition of pay-walled book content.'

Authors: We acknowledge the wide confidence intervals arising from the small sample of 34 legally obtained non-public books. The manuscript already reports the bootstrapped CIs and notes the resulting uncertainty. In the revised version we have further tempered the abstract language to stress the preliminary character of the findings and to ensure the interpretation remains appropriately cautious given the interval width. revision: yes

standing simulated objections not resolved

A full ablation holding model scale and architecture fixed while isolating training-data exposure is not possible with currently available proprietary models.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: direct empirical AUROC metrics from DE-COP application

full rationale

The paper reports empirical membership inference results by applying the existing DE-COP attack to a fixed dataset of 34 books and computing AUROC scores with bootstrapped confidence intervals for GPT-4o and GPT-4o Mini. No derivations, equations, or parameter fits are present that reduce to self-definition or rename fitted inputs as predictions. Model comparisons are presented as a partial control with explicit acknowledgment of scale and architecture differences as limitations, rather than as a load-bearing self-citation or uniqueness claim. The analysis is therefore self-contained against external benchmarks and does not exhibit any of the enumerated circular patterns.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

The central claim rests on the unvalidated applicability of the DE-COP attack to this book corpus and the premise that the 34 books contain no publicly duplicated content.

assumptions (1)

domain assumption DE-COP membership inference attack accurately detects inclusion of specific texts in LLM pre-training data
The paper invokes the method to interpret recognition patterns without additional validation or sensitivity analysis in this study.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Beyond Public Access in LLM Pre-Training Data." pith.science (2026). https://pith.science/paper/2505.00020

@misc{pith2026250500020,
  author       = {Pith},
  title        = {Pith review of: Beyond Public Access in LLM Pre-Training Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2505.00020}},
  note         = {Machine review of arXiv:2505.00020}
}

read the original abstract

Using a legally obtained dataset of 34 copyrighted O'Reilly Media books, we apply the DE-COP membership inference attack method to investigate whether OpenAI's large language models show recognition of copyrighted content. Our results based on this small sample suggest that GPT-4o, OpenAI's more recent and capable model, exhibits patterns consistent with recognition of pay-walled book content, with an AUROC score of 0.82 (95% bootstrapped CI: 0.60-0.96), though this wide confidence interval reflects substantial uncertainty due to the limited number of books tested. GPT-4o Mini, as a much smaller model, shows little recognition of any O'Reilly Media content with an AUROC score of 0.56 (0.28-0.83) for non-public data. Testing multiple models, with the same cutoff date, provides a partial control for potential language shifts over time that might bias our findings, though differences in model size, architecture, and potentially training data composition limit the strength of this control. These preliminary results underscore the importance of increased corporate transparency regarding pre-training data sources and the development of formal licensing frameworks for AI content training. Our principal contribution is our examination of public and non public data separately.

Discussion (0). Sign in to comment.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

IndisputableMonolith/Foundation/RealityFromDistinction.lean reality_from_one_distinction unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

We employ the DE-COP membership inference attack by Duarte et al. (2024) to test whether a model can reliably differentiate between human-authored (O'Reilly Media) texts and paraphrased LLM versions of the text... AUROC then aggregates these scores
IndisputableMonolith/Cost/FunctionalEquation.lean washburn_uniqueness_aczel unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

GPT-4o achieves an AUROC score of 0.82 (95% bootstrapped CI: 0.60–0.96) for non-public data

What do these tags mean?

matches: The paper's claim is directly supported by a theorem in the formal canon.
supports: The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends: The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses: The paper appears to rely on the theorem as machinery.
contradicts: The paper's claim conflicts with a theorem or certificate in the canon.
unclear: Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Pith tools

Reviewed May 22, 2026 · model on record in the stance chip above.